(feat): crypto migrations

src/sdk/encrypted-device-secret.ts

@@ -0,0 +1,74 @@
+export interface EncryptedDeviceSecretRecord {
+  userId: string;
+  deviceId: string;
+  secretId: string;
+  version: number;
+  encryptedSecret: Uint8Array;
+  wrappingPublicKeyId?: string;
+  wrappingScheme: string;
+  createdAt: number;
+  updatedAt: number;
+}
+
+export interface MTPEncryptedDeviceSecretProvider {
+  setEncryptedDeviceSecret(record: EncryptedDeviceSecretRecord): Promise<void>;
+  getEncryptedDeviceSecret(query: {
+    userId: string;
+    deviceId?: string;
+    secretId?: string;
+  }): Promise<EncryptedDeviceSecretRecord | null>;
+}
+
+function keyFor(record: Pick<EncryptedDeviceSecretRecord, "userId" | "deviceId" | "secretId">): string {
+  return `${record.userId}\0${record.deviceId}\0${record.secretId}`;
+}
+
+function cloneRecord(record: EncryptedDeviceSecretRecord): EncryptedDeviceSecretRecord {
+  return {
+    ...record,
+    encryptedSecret: new Uint8Array(record.encryptedSecret),
+  };
+}
+
+function validateEncryptedRecord(record: EncryptedDeviceSecretRecord): void {
+  if (!record.userId || !record.deviceId || !record.secretId) {
+    throw new Error("encrypted device secret requires userId, deviceId, and secretId");
+  }
+  if (!(record.encryptedSecret instanceof Uint8Array) || record.encryptedSecret.length === 0) {
+    throw new Error("encrypted device secret requires non-empty encryptedSecret bytes");
+  }
+  if (!record.wrappingScheme) {
+    throw new Error("encrypted device secret requires wrappingScheme");
+  }
+}
+
+export class InMemoryEncryptedDeviceSecretProvider implements MTPEncryptedDeviceSecretProvider {
+  private store = new Map<string, EncryptedDeviceSecretRecord>();
+
+  async setEncryptedDeviceSecret(record: EncryptedDeviceSecretRecord): Promise<void> {
+    validateEncryptedRecord(record);
+    const now = Date.now();
+    this.store.set(keyFor(record), cloneRecord({ ...record, updatedAt: record.updatedAt || now }));
+  }
+
+  async getEncryptedDeviceSecret(query: {
+    userId: string;
+    deviceId?: string;
+    secretId?: string;
+  }): Promise<EncryptedDeviceSecretRecord | null> {
+    if (!query.userId) {
+      throw new Error("userId is required");
+    }
+    if (query.deviceId && query.secretId) {
+      const found = this.store.get(`${query.userId}\0${query.deviceId}\0${query.secretId}`);
+      return found ? cloneRecord(found) : null;
+    }
+    for (const record of this.store.values()) {
+      if (record.userId !== query.userId) continue;
+      if (query.deviceId && record.deviceId !== query.deviceId) continue;
+      if (query.secretId && record.secretId !== query.secretId) continue;
+      return cloneRecord(record);
+    }
+    return null;
+  }
+}